The ConnectWise Automate Agent does not fully verify the authenticity of components that are loaded as plugins or obtained during self‑update operations. If an attacker supplies a malicious component or corrupts the update stream, the agent could execute arbitrary code with the privileges of the agent process. The impact is a full compromise of any machine running the affected Agent, allowing an attacker to gain confidentiality, integrity, or availability control.

The vulnerability affects ConnectWise Automate, both Cloud and on‑premises deployments. On‑prem users must apply the 2026.5 release to remediate; Cloud instances have already been updated to the latest version according to the vendor advisory. No specific sub‑versions beyond 2026.5 are listed.

The CVSS score of 8.8 classifies the issue as high severity. The EPSS score is not available, so the current probability of exploitation cannot be quantified from the data. The vulnerability is not listed in CISA KEV. Based on the components involved, the likely attack vector is during the plugin loading or automatic update process, which may be triggered by a remote update server. An attacker would need the ability to influence the update stream or supply a malicious plugin, which could be achieved through compromised update endpoints or social engineering of authenticated users.